You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@druid.apache.org by "gianm (via GitHub)" <gi...@apache.org> on 2026/08/19 21:01:49 UTC
[PR] feat: User-aware SchemaProviders for SQL. (druid)
gianm opened a new pull request, #20075:
URL: https://github.com/apache/druid/pull/20075
This patch adds a SchemaProvider interface, which can provide schemas based on the identity of the current user. SqlBindings#addSchemaProvider can be used by extension to add such providers.
In core, this patch moves the "druid", "view", and "sys" schemas to use schema providers that filter out unauthorized tables and views. This improves the behavior for unauthorized tables. Previously unauthorized tables were explicitly filtered out of InformationSchema, so users could not see them in metadata queries. However, they were visible to the validator, so a query that explicitly named such a table would return a "Forbidden" error. Now the error is "table not found".
To preserve the functioning of view expansion, views are now expanded using an escalated schema. Comments about the view security model are added to ViewManager's javadoc.
To ensure that table validation happens as expected at ingestion time, INSERT and REPLACE now require READ access (in addition to WRITE) on the target table.
A new configuration option "druid.sql.planner.authorizeTableVisibility" (default true) is added. If set explicitly to false, the old behavior is restored.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
Re: [PR] feat: User-aware SchemaProviders for SQL. (druid)
Posted by "gianm (via GitHub)" <gi...@apache.org>.
gianm commented on PR #20075:
URL: https://github.com/apache/druid/pull/20075#issuecomment-5348709337
Suggested release note:
> READ permissions are now required for tables to be visible to the SQL validator. This means that queries against tables where the user lacks READ permission now result in "not found" rather than "forbidden" errors. Additionally, INSERT or REPLACE into a table now requires both READ and WRITE permissions (rather than only WRITE). To restore the old behavior, set `druid.sql.planner.authorizeTableVisibility = false`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
Re: [PR] feat: User-aware SchemaProviders for SQL. (druid)
Posted by "github-advanced-security[bot] (via GitHub)" <gi...@apache.org>.
github-advanced-security[bot] commented on code in PR #20075:
URL: https://github.com/apache/druid/pull/20075#discussion_r3816859559
##########
sql/src/test/java/org/apache/druid/sql/calcite/util/TestDataBuilder.java:
##########
@@ -850,6 +850,15 @@
.build(),
index1
).add(
+ DataSegment.builder()
Review Comment:
## CodeQL / Deprecated method or constructor invocation
Invoking [DataSegment.builder](1) should be avoided because it has been deprecated.
[Show more details](https://github.com/apache/druid/security/code-scanning/11884)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
Re: [PR] feat: User-aware SchemaProviders for SQL. (druid)
Posted by "gianm (via GitHub)" <gi...@apache.org>.
gianm merged PR #20075:
URL: https://github.com/apache/druid/pull/20075
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
Re: [PR] feat: User-aware SchemaProviders for SQL. (druid)
Posted by "gianm (via GitHub)" <gi...@apache.org>.
gianm closed pull request #20075: feat: User-aware SchemaProviders for SQL.
URL: https://github.com/apache/druid/pull/20075
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org